739b9311d23b4a075697f239ceb37fb3459cff387a4f8d41cc2948dbec3ae320

Analysis

max time kernel
172s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:14

Target

739b9311d23b4a075697f239ceb37fb3459cff387a4f8d41cc2948dbec3ae320.dll
Size

96KB
MD5

6ec5664909110a09c8de8cc2b1c4c733
SHA1

caf50b50614b0d769d888f53e0e372c177b7ca60
SHA256

739b9311d23b4a075697f239ceb37fb3459cff387a4f8d41cc2948dbec3ae320
SHA512

99d51837d5558b99f0abc87de1fb6afd097254d503b740fe30fa866e094fba5854cec017c28b2c1e21269c03b6e20e0b389c8ba34f0ec03547ade0a5c01d32b2
SSDEEP

1536:SAVJ0mWeB/iU9NiwZppYARJm0ywkI+XWP96A3Gbl:zJ0mW8/iQLPpFRqzA19G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3056	2032	rundll32.exe	80
PID 2032 wrote to memory of 3056	2032	rundll32.exe	80
PID 2032 wrote to memory of 3056	2032	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\739b9311d23b4a075697f239ceb37fb3459cff387a4f8d41cc2948dbec3ae320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\739b9311d23b4a075697f239ceb37fb3459cff387a4f8d41cc2948dbec3ae320.dll,#1
  2⤵
  PID:3056

memory/3056-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download